{"id":37366,"date":"2021-02-23T19:57:35","date_gmt":"2021-02-23T17:57:35","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=37366"},"modified":"2025-08-29T15:58:35","modified_gmt":"2025-08-29T12:58:35","slug":"what-are-confidential-transactions-ct","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/what-are-confidential-transactions-ct\/","title":{"rendered":"What are Confidential Transactions (CT)?"},"content":{"rendered":"
\n
\n

What are Confidential Transactions?<\/strong><\/h2>\n<\/div>\n<\/div>\n
\n
Note: This article is outdated and awaiting an update.<\/strong><\/div>\n<\/blockquote>\n
<\/div>\n
\n
\n
Confidential Transactions (CT) is a cryptographic protocol that hides the recipient\u2019s address and the actual amounts on transaction inputs and outputs from third parties. At the same time, it lets anyone verify that the sum of all outputs does not exceed the sum of all inputs, which is sufficient to validate a transaction.<\/div>\n<\/div>\n
\n

Who invented Confidential Transactions, and when?<\/strong><\/h2>\n
\n

The first version of the concept, dubbed \u201cbitcoins with homomorphic value,\u201d was proposed<\/a> in 2013 by Hashcash inventor and Blockstream co-founder Adam Back.<\/p>\n

In 2015 the technology was first implemented in Blockstream\u2019s sidechain Elements<\/a>.<\/p>\n

The concept was later developed by Bitcoin Core developer Gregory Maxwell.<\/p>\n<\/div>\n<\/div>\n

\n

Why are Confidential Transactions needed?<\/strong><\/h2>\n
\n

Bitcoin does not provide full confidentiality. Because the blockchain is public, transaction-analysis tools can trace movements of funds and, in many cases, identify who is transacting.<\/p>\n

This lack of privacy undermines fungibility and increases the risk of censorship. Exchanges and other services may block users because their coins were previously involved in illegal activity, even if the current owner is unaware of that history. Confidential Transactions can, in principle, mitigate these problems.<\/p>\n<\/div>\n<\/div>\n

\n

How does the technology work?<\/strong><\/h2>\n
\n

The technology introduces new address and transaction formats. A transaction format comprises a scriptPubKey, a Pedersen commitment scheme, and an ECDH<\/a> (Elliptic-Curve Diffie\u2013Hellman) nonce.<\/p>\n

The scriptPubKey contains a Confidential Transaction Address (CTA) and a spending condition under which bitcoin may be spent only if ownership of the address\u2019s private key is proven with a signature.<\/p>\n

A Confidential Transaction Address is a hash of a blinding key plus a conventional bitcoin address.<\/p>\n

The blinding key hides both the bitcoin address and the transaction amount in the public ledger. Possession of the blinding key also lets one see the bitcoin address and the amount within the confidential transaction.<\/p>\n

A Pedersen commitment is a hash of the entire bitcoin output plus the blinding key.<\/p>\n

The ECDH nonce is a key that allows the entire confidential transaction to be revealed. It is used to transmit encrypted data to the transaction\u2019s recipient, who learns the bitcoin transaction output and the confidential transaction\u2019s blinding factor.<\/p>\n

Example of CTs in action.<\/em><\/p>\n

Alice has two bitcoins and wants to send one to Bob.<\/p>\n

After receiving Bob\u2019s address, Alice creates a blinding key and combines it with the address into a single hash. This produces a confidential address. Although it is recorded on the public ledger, no one besides Alice and Bob knows that the confidential transaction address corresponds to Bob\u2019s address.<\/p>\n

Example of a confidential address:<\/em><\/p>\n

CTEwQjyErENrxo8dSQ6pq5atss7Ym9S7P6GGK4PiGAgQRgoh1iPUkLQ168Kqptfnwmpxr2Bf7ipQsagi<\/p>\n

Alice then creates a confidential transaction. Using the same blinding key and a one-bitcoin output, she forms a Pedersen commitment. The amount Alice sends to Bob is hidden from the public, yet both of them can see it because they each possess the public blinding key. Alice has it as the creator; Bob can derive it with the private key of his bitcoin address.<\/p>\n

Next, Alice creates a scriptPubKey with the confidential transaction address she derived from Bob\u2019s bitcoin address, together with a spending condition stating that one bitcoin can be spent if Bob proves control of the address\u2019s private key with a signature.<\/p>\n

The transaction is then recorded on the public ledger.<\/p>\n<\/div>\n<\/div>\n

\n

How does the technology preserve balance consistency?<\/strong><\/h2>\n
\n

One key principle in Bitcoin is conservation of value: the amount of bitcoin credited to an address must equal the amount debited from it.<\/p>\n

Because Confidential Transactions hide amounts, two issues arise:<\/p>\n